CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Last updated
Overview
Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories. In cloud technologies and containers, this weakness might present itself in the form of misconfigured storage accounts that can be read or written by a public or anonymous user.
Real-world CVEs
299 recorded CVEs are caused by CWE-552 (Files or Directories Accessible to External Parties), including 4 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 60 new CWE-552 CVEs have been recorded so far in 2026 (63 in 2025).
- CVE-2020-17519CISA KEV
Apache Flink directory traversal attack: reading remote files through the REST API
Critical · CVSS 9.2 · EPSS 100th2021-01-05 - CVE-2025-11371CISA KEV
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
High · CVSS 8.7 · EPSS 100th2025-10-09 - CVE-2017-16651CISA KEVHigh · CVSS 8.3 · EPSS 98th2017-11-09
- CVE-2016-3715CISA KEVHigh · CVSS 7.2 · EPSS 99th2016-05-05
- CVE-2025-41240
Mounted Kubernetes Secrets under a predictable path located within the web server document root
Critical · CVSS 10.0 · EPSS 51th2025-07-24 - CVE-2024-56731
Gogs deletion of internal files allows remote command execution
Critical · CVSS 10.0 · EPSS 59th2025-06-24 - CVE-2024-39931Critical · CVSS 9.9 · EPSS 99th2024-07-04
- CVE-2021-32008Critical · CVSS 9.9 · EPSS 60th2022-03-04
- CVE-2021-43821Critical · CVSS 9.9 · EPSS 79th2021-12-14
- CVE-2026-2331
CVE-2026-2331
Critical · CVSS 9.8 · EPSS 57th2026-03-06 - CVE-2024-53676Critical · CVSS 9.8 · EPSS 99th2024-11-27
- CVE-2024-39581Critical · CVSS 9.8 · EPSS 33th2024-09-10
Showing 12 of 299 recorded CWE-552 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-552 vulnerabilitiesCommon consequences
What can happen when CWE-552 is exploited.
Read Files or Directories, Modify Files or Directories
Affects: Confidentiality, Integrity
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Technologies
How to prevent it
Practical mitigations for CWE-552, grouped by where in the lifecycle they apply.
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
How to detect it
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
The following Azure command updates the settings for a storage account:
Vulnerable example
az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access trueSafe example
az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access falseThe following Google Cloud Storage command gets the settings for a storage account named 'BUCKET_NAME':
Example
gsutil iam get gs://BUCKET_NAMEVulnerable example
"bindings":[{Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2005-1835 — Data file under web root.
Terminology & mappings
Mapped taxonomies
- OWASP Top Ten 2004: Insecure Configuration Management (A10) — CWE More Specific fit
- CERT C Secure Coding: Ensure that file operations are performed in a secure directory (FIO15-C)
Attack patterns
CAPEC attack patterns that exploit this weakness.
Frequently asked questions
Common questions about CWE-552.
- What is CWE-552?
- The product makes files or directories accessible to unauthorized actors, even though they should not be.
- What CVEs are caused by CWE-552?
- 299 recorded CVEs are attributed to CWE-552, including CVE-2020-17519, CVE-2025-11371, CVE-2017-16651. 4 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- Is CWE-552 part of the OWASP Top 10?
- CWE-552 maps to OWASP Top Ten 2004: Insecure Configuration Management (A10) in the OWASP security taxonomy.
- How do you prevent CWE-552?
- When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
- How is CWE-552 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-552?
- Exploiting CWE-552 can lead to: Read Files or Directories, Modify Files or Directories.
- Is CWE-552 actively exploited?
- Yes. 4 CWE-552 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 299 recorded CVEs.
References
- MITRE CWE definition (CWE-552) (opens in a new tab)
- CWE-552 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-552
Get alerted the moment a new CWE-552 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.